How to identify vulnerable customers: a prompt to ask, not a label

To identify vulnerable customers, a bank listens for what customers say about their circumstances, watches for how they are coping on the call or in the branch, notices what their accounts show, checks what it already holds about them, and, where a sign is clear, asks whether there is anything that would help, leaving the customer to decide what is noted. The UK's Consumer Duty asks firms to help frontline staff "actively identify" such information and to make disclosure easy; FCA guidance also says staff are not expected to go further than clear indicators. The difficulty is that the signs arrive in the middle of a payment query, on a busy line, and most customers never volunteer them. Botminds' Vulnerable Customer Support puts a Listening agent on the call: it hears a possible sign, checks the customer's file and prompts the colleague once, with words to ask. It records nothing; the customer and the colleague decide.

The framework here is the Financial Conduct Authority's. No US federal rule requires a bank to identify or record a customer's vulnerability; for US banks the FCA's approach is a model to borrow, not a rule to meet. The call used as the example is from a fictional sample bank, Corvane Bank UK.

How do you identify a vulnerable customer?

You identify a vulnerable customer from four sources of signal, used together: what they say, how they behave, what their accounts show, and what the bank already knows. None of them is a diagnosis. Each is a reason to ask a question or adapt the service, which is all the rules require.

The rule itself is short. PRIN 2A.7.4G says a firm should "assist frontline staff to understand how to actively identify information that could indicate vulnerability and, where relevant, seek information from retail customers with characteristics of vulnerability that will allow staff to respond to their needs", and should set up systems that let customers disclose. FG21/1 sets the edge of the duty: staff should encourage disclosure where they see clear indicators but "are not expected to go further than this to proactively identify vulnerability".

The fourth source is the one most often missed. The FCA's 2025 review of retail banks found staff who did not check, or did not act on, needs a customer had already disclosed (FCA retail banks review, 2025; the review is read in full in FCA vulnerable customers review 2025). Identifying a customer who has already told the bank is the cheapest identification there is, and the easiest to skip.

The four drivers of vulnerability, and what each sounds like on a call

The FCA groups characteristics of vulnerability under four drivers: health, life events, resilience and capability. FG21/1's Table 1 lists examples under each, from hearing or visual impairment and low mental capacity to bereavement, caring responsibilities, over-indebtedness and poor digital skills. The drivers matter for identification because each tends to surface differently.

The drivers are not equally common, and the most common is the least visible. In the FCA's 2024 survey, low resilience affected the largest share of UK adults, and it is the driver a customer is least likely to announce on a call about something else.

What are the signs of a vulnerable customer?

The signs of a vulnerable customer are mostly ordinary words and behaviours: a statement that they cannot pay, cannot read or cannot understand something; a request to repeat; mention of medication; confusion; distress; a third person speaking for them; and account changes such as payments stopping, missed payments or regular unarranged overdrafts. FG21/1 draws its list from the FCA's own practitioner material, and nearly every item can be heard on an ordinary service call.

The channel itself can be a sign. The FCA's survey found that 67% of adults with social or behavioural difficulties found dealing with customer services by phone confusing and difficult, and the regulator's 2025 good practice report found that at least 51% of adults with characteristics under all four drivers found the phone difficult because of their health, against 3% of those with none. A customer who gives up on the phone menu, or calls four times about one letter, is telling the bank something.

One category deserves care. Distress is a sign, not a need. In the sample call, the Listening agent hears possible distress at 0.81 confidence ("I’m all at sea with everything") alongside a possible bereavement at 0.96. The bereavement becomes a recorded need because Mrs Hollis agrees to it; the distress does not, because, as the screen puts it, the words describe her situation, not a diagnosis. Distress changes how the colleague handles the call. It does not belong on the customer's file.

The Listening agent in Vulnerable Customer Support: one prompt, the quoted words, the confidence

Should staff ask customers if they are vulnerable?

Staff should ask about needs, never about vulnerability. FG21/1 notes that "Consumers may not want the label ‘vulnerable’ applied to them" and suggests firms do not use it with customers at all. The useful question is practical: would it help if we noted this, so you do not have to explain it again? What would make this easier?

Asking matters more than most banks assume. In the FCA-commissioned research, about a quarter of people in vulnerable circumstances said they would feel uncomfortable explaining their situation, and "One in 5 (19%) of those who felt uncomfortable did not know their provider could take action to help." A well-put question solves the second problem directly. And the outcome of asking well is measurable: of those who did disclose, 74% agreed the provider asked the right questions. Why so many never disclose at all is the subject of our guide to customers in vulnerable circumstances.

There is also a point to stop. FG21/1 says that if a customer is clearly unwilling to share more, "it may not be reasonable for staff to continue asking questions." A decline is an answer. In the sample, a decline is kept with the call and the prompt does not repeat on that contact.

An agent that prompts once: seconds on one call

An agent that helps identification well does one narrow thing: it hears a possible sign, checks the customer's file, and gives the colleague one prompt with the passage, a confidence and words to ask. Everything after that is human. The design choice is deliberate. A system that labels customers automatically turns a possible sign into a recorded characteristic without the customer's knowledge; a prompt turns it into a question the customer can answer.

On the sample call the whole sequence takes about a minute, which is the practical argument for it. The colleague does not stop the call to fill in a form; the prompt arrives while the customer is still talking, and the saved need changes five of the customer's seven service channels at the same moment.

Why 0.70 and once per sign

A threshold and a limit on repetition are what keep a prompt useful. Set the threshold too low and colleagues learn to dismiss prompts; repeat a prompt and it becomes pressure on the customer. In the sample bank the Listening agent prompts only above 0.70 confidence and once per sign per contact, and both numbers are settings the bank owns, changed only with a written reason and the Consumer Duty manager's approval.

The right way to judge a setting is by what colleagues and customers do with the prompts. On the sample data, colleagues asked about 84.5% of the Listening agent's prompts, and compliance measures the agent's accuracy every month. The FCA's October 2026 publication on AI in financial services named the failure to avoid: some firms were treating a large language model as able to spot vulnerability without enough testing or safeguards (FCA, AI good practice, 2026), particularly for temporary characteristics. How to test a listening model before and after it goes live is covered in our guide to AI and vulnerable customers.

Payment patterns: signs nobody says aloud

Some signs never appear in conversation. FG21/1 lists changes in payment behaviour among the signs to look out for: payments stopping suddenly, late or missed payments, regular unarranged overdrafts and charges, and unusual activity. The FCA's 2025 bank review saw firms that "sought to proactively identify those potentially at risk of being in vulnerable circumstances, by, for example, using data like transaction patterns".

Bereavement shows how much an account can say. In the sample, Mrs Hollis did not know her late husband's £1,250 standing order to a care home was still being paid; it took her account past zero and triggered £35.00 of overdraft charges. Across the sample bank's third quarter, the Outcomes agent found 212 bereaved customers who had paid £7,480 of overdraft interest in the 30 days after the bank recorded their bereavement. A pattern like that is not a reason to label anyone; it is a reason to look back once a need is known, and to ask at the next natural contact.

Two cautions apply. A transaction pattern is personal data, and information from which a health condition can be inferred is likely to be special category data under UK data protection law even when the condition is never named, as FG21/1's appendix points out. And spotting possible financial exploitation by someone else is a different task with its own rules; for that, see the examples of elder financial exploitation series.

What staff should not do with a sign

A sign should change how a colleague serves the customer, and nothing more without the customer. The common mistakes are easy to list and easy to make on a busy line.

Consent in the customer's words, and a need drafted for the colleague to edit

What happens to that need after it is saved, and how a compliance team can tell whether the record is right and used, is the subject of our guide to recording vulnerability. The agents and screens are on the Vulnerable Customer Support page.

Questions people ask

How do banks identify vulnerable customers over the phone?

By listening for phrases and behaviours that suggest a need, such as "I can’t pay" or asking for repetition, checking needs already on file, and asking sensitively where a sign is clear. Some UK banks use speech analytics, in real time or after the call; the FCA's 2025 bank review described both as practice it had seen.

What are the four drivers of vulnerability?

Health, life events, resilience and capability, as set out in the FCA's guidance FG21/1. In the FCA's 2024 Financial Lives survey, 26% of UK adults had characteristics of low resilience, 20% a recent negative life event, 17% low capability and 9% poor health or a progressive condition.

Is identifying vulnerable customers a legal requirement?

In the UK the Consumer Duty, in force for open products since 31 July 2023, requires firms to deliver good outcomes for all retail customers, and its guidance at PRIN 2A.7.4G covers helping staff identify vulnerability. In the US no federal rule requires it, although related work, such as protecting older customers from exploitation, carries its own rules.

What should staff do if a customer declines to share?

Accept it, serve the customer as well as possible on that contact, and do not keep asking. FG21/1 says continuing may not be reasonable once a customer is clearly unwilling; in the sample bank the decline is kept with the call so the same question is not pushed again.

Can AI detect vulnerable customers?

AI can flag possible signs, and the FCA has described real-time speech-analytics prompts as good practice. It has also warned firms against assuming a language model can reliably identify vulnerability without testing, especially temporary characteristics, so the safer design is a prompt for a person rather than an automatic label.